Blob Blame History Raw
created according to:   https://github.com/libgd/libgd/commit/aba3db8
                        https://github.com/libgd/libgd/commit/a6a0e7feabb2a9738086a5dc96348f233c87fa79
                        https://github.com/libgd/libgd/commit/48bbc25
diff -urN '--exclude=cscope.*' gd-2.0.35/gd_gd2.c fixed/gd_gd2.c
--- gd-2.0.35/gd_gd2.c	2007-01-04 13:40:48.000000000 +0100
+++ fixed/gd_gd2.c	2020-11-04 08:46:03.800937688 +0100
@@ -169,11 +169,17 @@
     {
       nc = (*ncx) * (*ncy);
       GD2_DBG (printf ("Reading %d chunk index entries\n", nc));
+      if (overflow2(sizeof(t_chunk_info), nc)) {
+		goto fail1;
+      }
       sidx = sizeof (t_chunk_info) * nc;
+      if (sidx <=0) {
+		goto fail1;
+      }
       cidx = gdCalloc (sidx, 1);
-			if (!cidx) {
-				goto fail1;
-			}
+      if (cidx == NULL) {
+		goto fail1;
+      }
       for (i = 0; i < nc; i++)
 	{
 	  if (gdGetInt (&cidx[i].offset, in) != 1)